This is an automated email from the ASF dual-hosted git repository.
jomarko pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/incubator-kie-tools.git
The following commit(s) were added to refs/heads/main by this push:
new 87c38161054 [NO-ISSUE]: BPMN and DMN Standalone Editors: Inject the
envelope through the DOM instead of inlining it in srcdoc (#4055)
87c38161054 is described below
commit 87c38161054cf10495e785fca0619914c16d12ea
Author: Adarsh vk <[email protected]>
AuthorDate: Mon Oct 26 14:41:37 2026 +0530
[NO-ISSUE]: BPMN and DMN Standalone Editors: Inject the envelope through
the DOM instead of inlining it in srcdoc (#4055)
---
packages/bpmn-editor-standalone/src/index.ts | 11 +++++++----
packages/dmn-editor-standalone/src/index.ts | 11 +++++++----
2 files changed, 14 insertions(+), 8 deletions(-)
diff --git a/packages/bpmn-editor-standalone/src/index.ts
b/packages/bpmn-editor-standalone/src/index.ts
index 74a402bfd8c..78b43427ffa 100644
--- a/packages/bpmn-editor-standalone/src/index.ts
+++ b/packages/bpmn-editor-standalone/src/index.ts
@@ -64,16 +64,19 @@ export function open(args: {
<meta charset="UTF-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
-
- <script type="text/javascript">
- ${bpmnEnvelopeJs}
- </script>
</head>
<body>
<div id="envelope-app" />
</body>
</html>
`;
+ // The envelope is injected through the DOM rather than inlined in `srcdoc`,
so its code is never parsed as HTML.
+ // Inline script text breaks on `</script>`, or on `<!--` followed by
`<script`, which a bundle can't rule out.
+ iframe.addEventListener("load", () => {
+ const envelopeScript = iframe.contentDocument!.createElement("script");
+ envelopeScript.text = bpmnEnvelopeJs;
+ iframe.contentDocument!.head.appendChild(envelopeScript);
+ });
iframe.id = "bpmn-editor-standalone";
iframe.style.width = "100%";
iframe.style.height = "100%";
diff --git a/packages/dmn-editor-standalone/src/index.ts
b/packages/dmn-editor-standalone/src/index.ts
index 20f804b369d..a2748b984f3 100644
--- a/packages/dmn-editor-standalone/src/index.ts
+++ b/packages/dmn-editor-standalone/src/index.ts
@@ -64,16 +64,19 @@ export function open(args: {
<meta charset="UTF-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
-
- <script type="text/javascript">
- ${dmnEnvelopeJs}
- </script>
</head>
<body>
<div id="envelope-app" />
</body>
</html>
`;
+ // The envelope is injected through the DOM rather than inlined in `srcdoc`,
so its code is never parsed as HTML.
+ // Inline script text breaks on `</script>`, or on `<!--` followed by
`<script`, which a bundle can't rule out.
+ iframe.addEventListener("load", () => {
+ const envelopeScript = iframe.contentDocument!.createElement("script");
+ envelopeScript.text = dmnEnvelopeJs;
+ iframe.contentDocument!.head.appendChild(envelopeScript);
+ });
iframe.id = "dmn-editor-standalone";
iframe.style.width = "100%";
iframe.style.height = "100%";
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
